The Stack Overflow podcast is back! Listen to an interview with our new CEO.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*"
Favorites infavorites:mine
Status closed:yes
Types is:question
Exclude -[tag]
For more details on advanced search visit our help page
Results tagged with Search options answers only user 6035

Strengthening themes, plugins and core installation to prevent intrusion.

You could try hooking into template_include and showing the user a completely different page containing the login form (without changing the URL) if the post is password protected. Combine that WordP …
answered Jan 1 '13 by chrisguitarguy
We have to look a bit deeper here to get an answer to your question. So, bloginfo is a simple wrapper around get_bloginfo. <?php function bloginfo( $show='' ) { echo get_bloginfo( $show, 'displa …
answered Jan 14 '13 by chrisguitarguy
there's no benefit to moving wp-config outside the document root from a security perspective -- for the reasons above and these: You can restrict access to the file via your virtual host config or … . To me, moving wp-config out of the document root reeks of security by obscurity -- which is very much a straw man. …
answered Jul 18 '12 by chrisguitarguy
> tags, where ever they choose. Is is a security risk? Only if you give folks you don't trust admin and/or editor roles. Or someone gains access to your an admin/editor account. Or there's another … security hole somewhere in the core that allows privilege escalation from a lower to higher user level (unlikely). By itself, it's not a security risk. Admin and editors need to be able to do things to actually manage the site. …
answered Jan 1 '13 by chrisguitarguy
But how to know what is my WP namespace? namespacing a function, in WP land, just means prefixing it with something that makes it more unique and unlikely to conflict with anything else. Generall …
answered Oct 25 '15 by chrisguitarguy
You should use a nonce to protect yourself from CSRF attacks. Even though you're not sending anything to the database, I'd suggest using some of the built in data validation functions (there is even …
answered Mar 10 '12 by chrisguitarguy
should I install for a robust security infrastructure? Password-less SSH. And, since you're in control of the box you can have WordPress use bcrypt to hash passwords to make them slightly more secure … problems (whether it be performance or security breaches)? Take your pick. Look around. See what you need to monitor. There are uptime monitors, system performance monitoring solutions. Too broad …
answered Jan 9 '13 by chrisguitarguy